Task Management System vulnerabilities

A vulnerability has been found in code-projects Task Management System 1.0, specifically in the user profile update component, in the file /user/UpdateUserProfile.php. Manipulation of the lname argument results in cross-site scripting. The attack can be launched remotely, and the exploit has been made public.

SQL injection vulnerability in Task Management System 1.0, in the function Operation::select_with_multiple_condition in /index.php, in the Login Form component, via the email argument. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.